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We provide a quantum gambling protocol using three 
(symmetric) nonorthogonal states. The bias of the pro- 
posed protocol is less than that of previous ones, making it 
more practical. We show that the proposed scheme is secure 
against nonentanglement attacks. The security of the pro- 
posed scheme against entanglement attacks is shown heuris- 
tically. 
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I. INTRODUCTION 

Unforgeable quantum money proposed by Wiesner 0] 
opened the field of 'quantum cryptography'. The most 
successful of the quantum cryptographic protocols is 
Bennett and Brassard (BB84) quantum key distribution 
(QKD) protocol Q|, whose unconditional security was 
proved more than a decade later ||^. Since another very 
useful ingredient in cryptographic tasks is the bit com- 
mitment, there has been much effort to find an uncondi- 
tionally secure quantum bit commitment protocol. How- 
ever, it turns out that no such thing exists Q,^. This 
fact motivated the search for a slightly weaker protocol, 
quantum coin tossing. However, it turns out that the 
ideal quantum coin tossing protocol also does not exist 

. It is still an open question whether almost ideal quan- 
tum coin tossing exists or not ||^. However, it was found 
that there exists a quantum gambling protocol that is 
weaker than quantum coin tossing . 

We can say that the quantum money and the BB84 
protocol are based on a basic property of quantum me- 
chanics, the no-cloning theorem Another closely 
related but different property in quantum mechanics is 
that nonorthogonal quantum states cannot be distin- 
guished with certainty It is interesting to search 
for quantum protocols utilizing this property. Bennett's 
later QKD scheme indeed utilizes this property . Re- 
cently, Hwang et al. gave a quantum gambling scheme 
that utilizes this basic property p^ . 

The two quantum gambling protocols PJl^ are not 
ideal in the sense that there is a bias (5 > 0: It is an 
unfair game by the amount of the bias 5. That is, for each 
round of the game the expectation value of one party's 
gain is given by the bias 5. However, since the bias 5 is 
proportional to where R is the money penalty, the 

bias 5 can be made negligible by making R very large in 
both schemes ||^,[l3|]. 



In this paper, we provide a quantum gambling proto- 
col using three nonorthogonal states. In the proposed 
scheme, two participants Alice and Bob can be regarded 
as playing a game of making guesses at the identities of 
quantum states that are in one of three given nonorthog- 
onal states: If Bob makes a correct (incorrect) guess at 
the identity of a quantum state that Alice has sent, he 
wins (loses) . We show that the proposed scheme is secure 
against non-entanglement attacks. The security of the 
proposed scheme against entanglement attacks is shown 
heuristically. However, since the idea behind the proof 
is simple, we believe that a rigorous one will be found as 
in the case of the QKD The advantage of the 

proposed scheme over previous ones is that the bias 5 is 
proportional to 1/R. We discuss this advantage. 



II. QUANTUM GAMBLING USING THREE 
NONORTHOGONAL STATES 



Let us now describe the three symmetric nonorthog- 
onal states to be used in the protocol. Let 
denote a mixture of pure states with relative fre- 

quency pi with Y.iPi = 1- P = Z]iKN)(^l is a den- 
sity operator that corresponds to the mixture {pi,\i){i\}. 
Any pure quantum bits (qubits) can be represented 
by a (three-dimensional Euclidean) Bloch vecter as 
= (1/2)(1 + f,- a) Here 1 is the identity 

operator, a — {(Jx,(Ty,(yz), and o,j:,ay,az are the Pauli 
operators. The Bloch vectors of the three nonorthog- 
onal states I a), and |c) are in the same plane and 
make an angle 27r/3 with one another to be symmetric. 
Here we adopt \a) = |0), \b) = 1/2|0) + V3/2|l), and 
|c) = 1/2|0) - V3/2|l), where |0) and |1) denote two 
mutually orthogonal states of a qubit as usual. 

Let us now give the protocol. 

(1) Alice randomly chooses one among the three 
nonorthogonal states |a), \b), and |c), and sends it to 
Bob. 

(2) On the qubit he receives. Bob performs an optimal 
measurement, that is, a measurement by which he can 
obtain the maximal probability p of correctly guessing 
the identity of the qubit. 

(3) On the basis of the measurement's results, he makes a 
guess at which one the qubit is and annouces it to Alice. 

(4) If he made a correct (incorrect) guess, Alice an- 
nounces he has won (lost). 

(5) When Bob has won, Alice gives him one coin. When 
he has lost, Bob gives her p/{l— p) coins. 
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However, after the first step, Bob follows the following 
steps 6 — 9 instead of steps 2 — 5, at randomly chosen 
instances with a rate r (0 < r <C 1). 

(6) Bob performs no measurement on the qubit and stores 
it. 

(7) He announces his randomly chosen guess at the iden- 
tity of the qubit. 

(8) Step 4 is repeated. 

(9) In the previous step, Alice has actually revealed which 
one she chose to tell him the qubit is (regardless of her 
honesty). When it is \a) {a = a,h,c), Bob performs Sa- 
(Sa is an orthogonal measurement that is composed of 
two projection operators |q;)(q;| and |q;')(q;'|. Here \a') 
is a normalized state that is orthogonal to |a).) If the 
outcome is |a'). Bob announces that he performed Sa 
and got as an outcome. Then Alice must give him 
R 1) coins. If the outcome is |a). Bob says nothing 
about which measurement he performed and follows step 
5. □ 

As in the two-state scheme [ p^ , it is important in step 
2 for Bob to perform the optimal measurement that as- 
sures maximal probability p of correctly guessing the 
identity of the qubit, in order to assure his maximal 
gain. The optimal measurment for the three nonorthog- 
onal states \a) was recently given It is a positive 

operator valued measurement (POVM) whose com- 
ponent operators are, interestingly, proportional to the 
three operaters That is, they are (2/3)|a)(a|, 

(2/3)|6)(6|, and (2/3)|c)(c|. Now it is easy to see that the 
maximal probability p is 2/3. 

III. SECURITY OF THE PROTOCOL 

Now let us show how each player's average gain is as- 
sured. (Here we repeat the corresponding part of Ref. 
|p3| in a slightly varied form.) 

First it is clear by definition that Bob can do nothing 
better than performing the optimal measurement, as long 
as Alice prepares the specified qubits. In the protocol, 
the numbers of coins that Alice and Bob pay are adjusted 
so that no one gains when Bob's win probability is p. 
Thus Bob's gain Gb cannot be greater than zero, that 
is, Gb < 0. 

Next let us consider Alice's strategy. As noted above, 
we first show the security against Alice's nonentangle- 
ment attacks. Roughly speaking, Alice can do nothing 
but prepare the given states |a) and honestly tell Bob 
the identity of the state later. Otherwise she must pay R 
(^ 1) coins to him sometimes, making her gain negative. 
Let us consider this more precisely. In the most general 
nonentanglement attacks, Alice randomly generates each 
qubit in a state \i) with a probability pi. Here the |z)'s 
are arbitrarily specified states of qubits, i = 1,2,..., N 
and X]f -Pi ~ 1- However, since Bob has no informa- 
tion about which \i) Alice has selected at each instance. 



his treatments of the qubits actually become equal for 
all qubits. Thus it is sufficient to show the security for 
a qubit in an arbitrary state. Let us denote the angles 
that the Bloch vector of a state \i) makes with those of 
I a) as 9a. At ramdomly chosen instances with a rate 
r. Bob checks Alice's claim by measuring Sa when the 
claim is that the state is |a) (the steps 6 — 9). If the mea- 
surement's outcomes are \a'), the claim is proved wrong. 
Then Alice must give Bob R coins. The probability that a 
state \i) is checked is — 1 — cos^(0q/2) in the case 

when the checking measurement Sa is performed. Thus 
one term in Alice's gain Ga is —rR[l — cos^{da/'2)] where 
rR is set to be much larger than 1. Now it is simple to 
see that Alice should prepare only states that are highly 
nonorthogonal to one of the |a)'s. Thus one of the 6a is 
very small. Otherwise, Alice's gain Ga will be dominated 
by highly negative term —rR[l — cos^(6'a/2)] in any case. 
Similarly we can see that she should claim the prepared 
state to be the one that is nearest to it. Here it should 
be noted that we should take into account the fact that 
Alice obtains partial information about whether Bob has 
performed the measurement or not, due to Bayes' rule. 
However, Alice still cannot increase her gain as long as 
the R is large enough, because she cannot be confident 
that Bob has already performed the measurement. Let 
be Alice's estimation of the probability that Bob did not 
perform the measurement. With no information, is r. 
However, Bob's announced guess gives her partial infor- 
mation about his measurement's result if he performed it. 
This information can be used to make a better estimate 
of /„. For example, in the case where Alice sends \a) and 
Bob performs the optimal measurement, we obtain using 
Bayes' rule that = (r/3)/[(r/3) + (l - r)(2/3)] when 
his guess is |a). However, it is clear that /„ > r/3: when 
Bob did not perform the measurement, he simply guesses 
it with equal probabilities regardless of what he received. 
Thus, by Bayes' rule, Alice can see that there remains 
a probability greater than r/3 that Bob did not perform 
the measurement. The relation > r/3 also holds for 
the entanglement attacks, since it is satisfied for any \a). 

Now let us consider a state \i) that satisfies the re- 
quirements 6a ^ 0, Oh ^ 27r/3, and 6c ^ 27r/3, without 
loss of generality. The probability Pc that Bob makes 
a correct guess is given by Pc = (2/3) cos^(0a/2). That 
for an incorrect one is given by P/ = 1 — Pc. Alice's gain 
is —1 (2) when Bob makes a correct (incorrect) guess. 
Let us denote Alice's gain G\ {Ga) in the case of the 
normal (checking) steps. Alice's total gain is given by 
Ga = (1 " '")G'^ + ''"Ga- Ahce's gain in the case of 
the normal steps can be obtained as 

Gl = (-l)(2/3) cos^{6a/2) + 2{1 - (2/3) cos^{6a/2)} 
= 2{l-cos2(ea/2)}. (1) 

Alice's gain Ga in the case of the checking steps (when 
Alice claims that the sent qubit is \a)) is given by 



2 



G\ = -R[l - cos2(0,/2)] + cos2(0,/2). (2) 

The second term in the right-hand side of Eq. (||) is 
because Bob makes a random guess without performing 
the optimal measurement in the checking steps and thus 
it is disadvantageous for him. Then we can obtain that 

Ga - (1 - r)2{l - cos2(0„/2)} - rR{l - cos^Oa/^)} 
+rcos2(0,/2) 
= {2 - r{R + 2)}{1 - cos2(0,/2)} + r cos2(0j2). (3) 

Here it is easy to see that if r(_R + 2) ^ 2 the opti- 
mal choice for Alice is that 9a — 0. Then the maximal 
gain for Alice is given by G™°^ = r. If we determine 
the values of r and R such that they satisfy the relation 
r{R -I- 2) = fc ^ 2 (fc is a constant), Alice's maximal 
gain or the bias 5 is r. Thus the bias 5 is proportional 
to 1/R. The basic reason for this advantage is that the 
measured states \a) coincide with the elements of the 
optimal POVM in the proposed scheme. Alice could in- 
crease her gain G\ for the normal steps by increasing Oa 
in both two- and three-state schemes but with the fol- 
lowing difference. In the three-state (two-state) scheme, 
increases with the second (first) order of Oa while the 
probability to be checked increases with the second order 

of Oa. 

Let us heuristically show the security against Alice's 
entanglement attacks. In entanglement attacks, she does 
not send a separate state but sends qubits that are en- 
tangled with some other qubits she preserves. If she 
can change Bob's state ps as she likes, she can always 
win. The basic idea is that she cannot do so even in 
entanglement attacks. Instead, by appropriately choos- 
ing her measurement, Alice can generate at Bob's site 
any ensemble satisfying '^iPi\i){i\ = pB (the 

theorem of Hughston, Jozsa, and Wootters) Let 
PB = (l/2)(H-f • ct). Since pB = Z]iPiN)(*l and \i){i\ = 
(1/2)(1 -\-fi-ij) where f,; is the corresponding Bloch vec- 
tor, we have (1/2)(1 + f • ct) = {l/'2.){l + ^^p^f^]■ a) and 
thus 

f ^^Piff (4) 

i 

Therefore, for a given pB whose Bloch vector is f, Al- 
ice can prepare at Bob's site any mixture {pi, \i){iW as 
long as its Bloch vectors fi satisfy Eq. (^. However, if 
Alice always performs a given measurement, the entan- 
glement attacks reduce to the nonentanglement attacks: 
The outcomes of measurements on entangled pairs do not 
depend on the temporal order of the two participants' 
measurements. So we can confine ourselves to the case 
where Alice measures first. Then the attack reduces to 
a nonentanglement attack where Alice generates \i) with 
probability Pi. The only thing that Alice can do to utilize 
the entanglement is to choose her measurements accord- 
ing to Bob's announced guesses. However, the checking 



steps also prevent Alice from increasing her gain: She 
must choose the measurement that gives some mixture 
{pi,\i){i\} at Bob's site such that each fi is the same 
as one of the Bloch vectors of the three nonorthogonal 
states I a). This is because any vector fi that deviates 
from those of the |a)'s will decrease Alice's gain due to 
the checking steps, involving a negative term containing 
rR. Therefore, Alice has no freedom in the choice of mea- 
surements but a given choice. Thus the attack reduces 
to nonentanglement attacks for the reasons noted above. 

IV. DISCUSSION AND CONCLUSION 

Let us discuss the advantage of the proposed scheme. 
The problem of quantum gambling schemes is that Alice 
can claim that the error is due to noise or decoherence 
in the quantum channel, whenever it is checked and thus 
she must pay R to Bob. This problem cannot be clearly 
solved even if quantum error correcting codes are 
successfully implemented because a small amount of error 
always remains. The solution to this problem is that Bob 
aborts the whole protocol if the error rate claimed by Al- 
ice is greater than the expected residual error rate. How- 
ever, Bob should actually accept his loss which amounts 
to the product of the number of errors and i?, until data 
for a sufficient number of errors accumulate. Thus it is 
hard for Bob to do so when R is too large. However, in 
the previous schemes (proposed scheme), we have that 
R ^ 1/(5^ [R ^ \/5), namely, for a given bias the value 
of R of the proposed scheme is less than that of the pre- 
vious schemes by a factor of 1/5. Therefore we can say 
that the proposed scheme is more practical than previous 
ones. 

In conclusion, we provided a quantum gambling pro- 
tocol using three (symmetric) nonorthogonal states. We 
showed that the proposed scheme is secure against nonen- 
tanglement attacks. The security of the proposed scheme 
against entanglement attacks was shown heuristically. 
The advantage of the proposed scheme over previous ones 
is that the bias 5 is proportional to 1/R. We discussed 
its practical advantage. 
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